CVE-2026-87902
KEVHIGH 8.1EPSS 40.0%
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
- Affected
- WordPress
- CVSS v3.1 CNA
- 8.1 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 39.98% chance of exploitation in the next 30 days, 99th percentile
- CISA KEV
- added 2026-09-25
- Nuclei
- critical · CWE-98
- Published
- 2026-09-22
- Updated
- 2026-09-26
Proof-of-concept exploits (18)
- ressl/cve-2026-87902-poc39★ · 2026-09-22
- abraxas/CVE-2026-8790235★ · 2026-10-07
- vulpecuna/CVE-2026-879029★ · 2026-09-23
- pwnVader/CVE-2026-87902-PoC-pwnVader0★ · 2026-09-22
- zer0dayf/CVE-2026-879020★ · 2026-09-23
- bhideki/CVE-2026-879022★ · 2026-09-23
- oliveiralimajr/CVE_2026_879026★ · 2026-09-23
- tc4dy/CVE-2026-87902-Toolkit14★ · 2026-10-12
- nextco/wordpress-cve-2026-879020★ · 2026-09-24
- Lutfifakee-Project/CVE-2026-879020★ · 2026-09-24
- khellwan/CVE-2026-87902_PoC3★ · 2026-09-25
- crowsec-edtech/CVE-2026-879023★ · 2026-09-25
- Maalfer/CVE-2026-87902-exploit2★ · 2026-09-27
- HackfutSecRoot/CVE-2026-879023★ · 2026-10-03
- MRdark-ops/CVE-2026-879020★ · 2026-09-28
- tonydelouvre/CVE-2026-879026★ · 2026-09-29
- dinosn/cve-2026-87902-wordpress-lfi-lab/blob/937ab539fee77c85bb8ea2ba6a3d5a01bc353f98/poc…13★ · 2026-09-23
- Hassham1/CVE-2026-87902/blob/854c1255d4da0fa59551a8a3194c65fc81e4dbe6/poc/poc_cve_2026_87…2★ · 2026-09-23
Nuclei templates (1)
ExploitDB entries (1)
Security advisories
- WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
- https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-…